Trust Center
Your tax return holds your PAN, income, bank account and family details. Here's exactly how we protect them, what we're certified for, and where we're heading.
Last reviewed 13 October 2026.
Certifications
| Standard | Status |
|---|---|
| SOC 2 (Type I, then Type II) | We're working towards it. We'll publish the auditor's report here once it's issued. |
| ISO/IEC 27001 | We're working towards it. We'll publish the certificate here once it's issued. |
| The services we run on | Cloudflare, which hosts our website, database and documents, and Google, which runs our email, each hold SOC 2 Type II and ISO/IEC 27001 certifications of their own. |
We follow written security policies covering access, encryption, incidents, data retention, suppliers, backups and how we build and release changes. They're the same controls these audits check.
Encryption
- In transit: every page and connection uses HTTPS, and browsers are told never to connect to us without it.
- At rest: our database and document storage are encrypted by Cloudflare.
- With our own keys: on top of that, every document you share with us is encrypted by FileITR with AES-256-GCM before it's stored. Each document has its own key, and those keys are locked with a master key only FileITR holds. Someone with access to the storage alone would see only scrambled data.
Who can see your data
- Only FileITR team members, signing in with a one-time code to a company email, through Cloudflare Access. Every request is checked against our team list, so access ends the moment someone leaves.
- Your documents are never publicly reachable, and they always download as files, never open inside a web page.
- Every document upload, download and deletion, and every change to our team, is recorded with who did it and when.
Your e-filing portal login
Sharing it is always your choice. If you do, only your assigned expert uses it, only for the task you asked for, and never to file, change your bank account or contact details, or reply to anything without your approval. We remove it from our chat records as soon as it's used, and you can end our access at any time by changing your password. Read the full commitment.
Privacy by design
- Our calculators run in your browser. The numbers you type aren't sent to us.
- We store no IP addresses with your enquiries, and we never sell your data.
- You can ask us to show, correct or delete your data at any time, under India's Digital Personal Data Protection Act, 2023.
How we build and release
- Every release must pass more than 21,000 automated checks first: tax calculations, every calculator, the sign-in gate, document storage, and the layout of every page on phones and computers.
- Our code is reviewed for security regularly. The latest full review found no exploitable issues.
- Database queries are built safely, so typed text can't be run as a command, and the website blocks scripts from anywhere we haven't approved.
If something goes wrong
We have a written incident plan. If your data were ever affected, we'd tell you without delay, with what happened and what to do, and report it to CERT-In and the Data Protection Board of India as the law requires.
Our service providers
| Provider | What they do for us |
|---|---|
| Cloudflare | Website hosting, our database, document storage and team sign-in |
| Email, and page-visit statistics only if you allow them | |
| Income Tax Department | The e-filing portal, where we file your return |
Report a security issue
Found a vulnerability? Email [email protected] with "Security" in the subject. Please don't access other people's data or disrupt the service while testing. We'll reply within 3 working days. Our security.txt has the same details.
More detail: how we keep your information safe, our privacy policy and our terms of use.